Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,823 results · page 4 of 37
Oct 1, 2026Mamunur Rashid Review Schema review-schema: Missing AuthorizationCVE-2026-97280 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Review Schema: 3.1.0.
- Product
- Mamunur Rashid Review Schema review-schema
- What to do
- Update Mamunur Rashid Review Schema review-schema to the newest version.
Oct 1, 2026Photo Reviews for WooCommerce: Authorization Bypass Through User-Controlled KeyCVE-2026-100517 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Authorization Bypass Through User-Controlled Key vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30.
- Product
- Photo Reviews for WooCommerce
- Affected
- up to 1.2.30
- What to do
- Affects up to 1.2.30. Update Photo Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 1, 2026Site Reviews: Missing AuthorizationCVE-2026-103340 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.2.
- Product
- Site Reviews
- Affected
- up to 8.3.2
- What to do
- Affects up to 8.3.2. Update Site Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 1, 2026Payments for Hubtel: Does not prevent public access to a debug log inCVE-2026-96255 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, including the store's payment gateway API credentials in plain text, allowing unauthenticated attackers to obtain those credentials.
- Product
- Payments for Hubtel
- Fixed in
- 1.0.2
- What to do
- Update Payments for Hubtel to 1.0.2 or newer.
Oct 1, 2026Five Star Restaurant Reviews: Does not properly escape a user-supplied value before outputting it into an HTML tagCVE-2026-92412 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an HTML tag, allowing unauthenticated attackers to inject arbitrary web script that runs in the browser of anyone tricked into submitting a crafted request, including a logged-in administrator.
- Product
- Five Star Restaurant Reviews
- Fixed in
- 2.3.14
- What to do
- Update Five Star Restaurant Reviews to 2.3.14 or newer.
Sep 30, 2026Event Tickets: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-97287 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Blind SQL Injection. This issue affects Event Tickets: from n/a through 5.29.5.
- Product
- Event Tickets
- Affected
- up to 5.29.5
- What to do
- Affects up to 5.29.5. Update Event Tickets to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordintrudify.compatchstack.com
Sep 30, 2026Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.CVE-2026-97285 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.
- Affected
- up to 6.17.5
- What to do
- Affects up to 6.17.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions.CVE-2026-97282 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Unauthenticated Insecure Direct Object References (IDOR) in Review Schema <= 3.1.0 versions.
- Affected
- up to 3.1.0
- What to do
- Affects up to 3.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.CVE-2026-97267 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.
- Affected
- up to 2.6.7
- What to do
- Affects up to 2.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions.CVE-2026-96823 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions.
- Affected
- up to 5.120.0
- What to do
- Affects up to 5.120.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.CVE-2026-94078 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.
- Affected
- up to 8.3.1
- What to do
- Affects up to 8.3.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 30, 2026YayReviews: Does not restrict access to an API route that returns individual customer review recordsCVE-2026-94274 · WordPress plugins & themes · reported by WPScanMedium 5.3
The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, including reviews still pending moderation, allowing unauthenticated attackers to harvest reviewers' email addresses and other non-public review content.
- Product
- YayReviews
- Fixed in
- 1.4.1
- What to do
- Update YayReviews to 1.4.1 or newer.
Sep 30, 2026EWWW Image Optimizer: Does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserializedCVE-2026-91051 · WordPress plugins & themes · reported by WPScanMedium 6.6
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present via another installed EWWW Image Optimizer WordPress plugin before 8.8.0 or .
- Product
- EWWW Image Optimizer
- Fixed in
- 8.8.0
- What to do
- Update EWWW Image Optimizer to 8.8.0 or newer.
Sep 30, 2026Image Optimizer: Does not enforce its intended capability check on several of its read REST routesCVE-2026-90953 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators.
- Product
- Image Optimizer
- Fixed in
- 1.7.7
- What to do
- Update Image Optimizer to 1.7.7 or newer.
Sep 30, 2026Vayu X: Does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in userCVE-2026-88797 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Vayu X WordPress theme before 1.0.6 does not perform any capability check on one of its AJAX actions and exposes the nonce guarding it to every logged-in user, allowing any authenticated user, such as a subscriber, to install and activate any hosted on the WordPress.org repository.
- Product
- Vayu X
- Fixed in
- 1.0.6
- What to do
- Update Vayu X to 1.0.6 or newer.
Sep 30, 2026Hostinger Reach: Does not sanitize and escape a widget setting before outputting it in the editor previewCVE-2026-87777 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Hostinger Reach WordPress plugin before 1.8.3 does not sanitize and escape a widget setting before outputting it in the editor preview, allowing users with contributor-level access and above to inject arbitrary web scripts that will execute in the session of a higher-privileged user who opens the affected content in the editor.
- Product
- Hostinger Reach
- Fixed in
- 1.8.3
- What to do
- Update Hostinger Reach to 1.8.3 or newer.
Sep 30, 2026Solace Extra: Does not perform any authorization or post-status checks on its front-end preview routesCVE-2026-80333 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Solace Extra WordPress plugin before 1.7.2 does not perform any authorization or post-status checks on its front-end preview routes, allowing unauthenticated visitors to read the rendered content of non-published posts and pages of any type that WordPress would otherwise not serve.
- Product
- Solace Extra
- Fixed in
- 1.7.2
- What to do
- Update Solace Extra to 1.7.2 or newer.
Sep 30, 2026User Frontend: Does not prevent tampering with the role assigned by its registration formCVE-2026-75823 · WordPress plugins & themes · reported by WPScanHigh 7.4
The User Frontend WordPress plugin before 4.3.12 does not prevent tampering with the role assigned by its registration form, allowing unauthenticated users to register with a higher privileged role, such as Editor. This affects installations running a PHP build where the sodium extension is unavailable, and where a registration page has been configured. The administrator role cannot be obtained this way.
- Product
- User Frontend
- Fixed in
- 4.3.12
- What to do
- Update User Frontend to 4.3.12 or newer.
Sep 28, 2026The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path, allowing the holder CVE-2026-88828 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path, allowing the holder of an account the site owner has blocked to keep authenticating with that account's privileges, without the block being enforced or recorded.
- What to do
- Update the plugin to the newest version.
Sep 27, 2026NextScripts: Social Networks Auto-Poster: Does not perform capability or ownership checks on several of its AJAX actionsCVE-2026-97227 · WordPress plugins & themes · reported by WPScanMedium 5.9
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access to its posting features to export the site's configured social account credentials, delete arbitrary posts and reset the NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8's configuration.
- Product
- NextScripts: Social Networks Auto-Poster
- Fixed in
- 4.4.8
- What to do
- Update NextScripts: Social Networks Auto-Poster to 4.4.8 or newer.
Sep 27, 2026Online Scheduling and Appointment Booking System: Does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administratorsCVE-2026-86841 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an administrator must explicitly assign, to inject arbitrary PHP objects, overwrite privileged site options, and read stored integration secrets.
- Product
- Online Scheduling and Appointment Booking System
- Fixed in
- 28.3
- What to do
- Update Online Scheduling and Appointment Booking System to 28.3 or newer.
Sep 26, 2026MCP Server for WordPress: Does not perform an object-level authorization check on one of its workflow REST routesCVE-2026-96526 · WordPress plugins & themes · reported by WPScanLow 2.7
The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST routes, allowing users with the Contributor role to disclose the title and publication status of any post, page or custom post type, including other users' private, draft, pending and scheduled content.
- Product
- MCP Server for WordPress
- Fixed in
- 1.8.2
- What to do
- Update MCP Server for WordPress to 1.8.2 or newer.
Sep 26, 2026wp-review-slider-pro: Does not sanitize a value stored through one of its AJAX handlersCVE-2026-84097 · WordPress plugins & themes · reported by WPScanMedium 6.5
The wp-review-slider-pro WordPress plugin before 12.7.12 does not sanitize a value stored through one of its AJAX handlers, which lacks a capability check, before using it in a SQL statement, allowing any authenticated user, such as a subscriber, to perform SQL injection attacks whose results are then returned to unauthenticated visitors.
- Product
- wp-review-slider-pro
- Fixed in
- 12.7.12
- What to do
- Update wp-review-slider-pro to 12.7.12 or newer.
Sep 26, 2026wp-review-slider-pro: Does not perform a capability check on the AJAX handler that saves its review submission formsCVE-2026-84096 · WordPress plugins & themes · reported by WPScanHigh 8
The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on the AJAX handler that saves its review submission forms, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to overwrite a live form with field values that are output without escaping on public pages, leading to Stored Cross-Site Scripting.
- Product
- wp-review-slider-pro
- Fixed in
- 12.7.12
- What to do
- Update wp-review-slider-pro to 12.7.12 or newer.
Sep 26, 2026wp-review-slider-pro: Does not perform a capability check on one of its AJAX handlersCVE-2026-84095 · WordPress plugins & themes · reported by WPScanHigh 8
The wp-review-slider-pro WordPress plugin before 12.7.12 does not perform a capability check on one of its AJAX handlers, and the nonce protecting it is generated for every visitor, allowing any authenticated user, such as a subscriber, to store arbitrary review content which is later output without escaping on public pages, leading to Stored Cross-Site Scripting.
- Product
- wp-review-slider-pro
- Fixed in
- 12.7.12
- What to do
- Update wp-review-slider-pro to 12.7.12 or newer.
Sep 26, 2026File Manager: Does not prevent unauthenticated users from downloading its database backup archivesCVE-2026-19708 · WordPress plugins & themes · reported by WPScanMedium 5.9
The File Manager WordPress plugin before 8.0.5 does not prevent unauthenticated users from downloading its database backup archives, and in some cases writes them under a fixed filename, allowing unauthenticated attackers to retrieve a full database dump including every user's email address and password hash on servers that do not apply the directory's .htaccess file.
- Product
- File Manager
- Fixed in
- 8.0.5
- What to do
- Update File Manager to 8.0.5 or newer.
Sep 25, 2026BA Book Everything: Stored Cross-Site ScriptingCVE-2026-96039 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via first_name Parameter in all versions up to, and including, 1.8.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. An unauthenticated attacker can obtain the valid order_id, order_num, and order_hash credentials required to reach the vulnerable action_to_pay() handler simply by placing a guest booking through the public [babe-booking-form] shortcode, making the full exploit chain reachable without any account.
- Product
- BA Book Everything
- Affected
- up to 1.8.27
- What to do
- Affects up to 1.8.27. Update BA Book Everything to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 25, 2026Customer Reviews for WooCommerce: Authorization bypassCVE-2026-89055 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.120.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to permanently delete arbitrary attachments from the Media Library — including administrator-owned product images, logos, and documents — by injecting their IDs into a review that is later trashed and purged. Exploitation requires a public review-form link (a 13-hex formId distributed to customers via e-mail), which exposes the nonce needed to reach the handler without any WordPress account or session.
- Product
- Customer Reviews for WooCommerce
- Affected
- up to 5.120.0
- What to do
- Affects up to 5.120.0. Update Customer Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 24, 2026Events Manager: Does not force the scope of its logged-in event and location searchCVE-2026-93662 · WordPress plugins & themes · reported by WPScanMedium 4.3
The Events Manager WordPress plugin before 7.4.5 does not force the scope of its logged-in event and location search when a caller supplies their own owner value, letting a low-privileged user read other accounts' unpublished, pending or trashed event and venue content, including full street addresses.
- Product
- Events Manager
- Fixed in
- 7.4.5
- What to do
- Update Events Manager to 7.4.5 or newer.
Sep 24, 2026Events Manager: Does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized againstCVE-2026-93661 · WordPress plugins & themes · reported by WPScanLow 2.7
The Events Manager WordPress plugin before 7.4.5 does not stop a ticket-update request from replacing the identifiers of the ticket it was authorized against, letting a user who can manage one event's tickets overwrite and reassign any ticket on the site to their own event.
- Product
- Events Manager
- Fixed in
- 7.4.5
- What to do
- Update Events Manager to 7.4.5 or newer.
Sep 24, 2026WPeMatico RSS Feed Fetcher: Does not sanitize and escape content it retrieves from a user-supplied source before rendering itCVE-2026-89002 · WordPress plugins & themes · reported by WPScanMedium 6.8
The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.26 does not sanitize and escape content it retrieves from a user-supplied source before rendering it, which could allow users such as contributors to perform Stored Cross-Site Scripting attacks against higher-privileged users who review the campaign.
- Product
- WPeMatico RSS Feed Fetcher
- Fixed in
- 2.8.26
- What to do
- Update WPeMatico RSS Feed Fetcher to 2.8.26 or newer.
Sep 23, 2026Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.CVE-2026-93526 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.
- Affected
- up to 5.29.4
- What to do
- Affects up to 5.29.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 23, 2026Event Booking Manager for WooCommerce: Does not restrict its event listing query to events the requesting user is permitted to readCVE-2026-91077 · WordPress plugins & themes · reported by WPScanLow 2.7
The Event Booking Manager for WooCommerce WordPress plugin before 5.7.3 does not restrict its event listing query to events the requesting user is permitted to read, so users with contributor-level access and above can retrieve other authors' private, draft and trashed events, together with event detail the standard listing does not show them. This discloses private events and their content that WordPress withholds from users lacking the read_private_posts capability.
- Product
- Event Booking Manager for WooCommerce
- Fixed in
- 5.7.3
- What to do
- Update Event Booking Manager for WooCommerce to 5.7.3 or newer.
Sep 23, 2026JSM Show Post Metadata: Does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta boxCVE-2026-88997 · WordPress plugins & themes · reported by WPScanMedium 6.8
The JSM Show Post Metadata WordPress plugin before 4.9.1 does not properly escape a post meta key before outputting it into an inline event-handler attribute in an admin-facing meta box, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of a higher-privileged user who reviews the affected post.
- Product
- JSM Show Post Metadata
- Fixed in
- 4.9.1
- What to do
- Update JSM Show Post Metadata to 4.9.1 or newer.
Sep 23, 2026Paymob for WooCommerce: Does not perform a capability check on several admin AJAX actions that manage its payment-gateway configurationCVE-2026-87981 · WordPress plugins & themes · reported by WPScanMedium 4.7
The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway configuration, allowing users with contributor-level access to delete, wipe, or modify that configuration, including the stored payment credentials.
- Product
- Paymob for WooCommerce
- Fixed in
- 4.1.14
- What to do
- Update Paymob for WooCommerce to 4.1.14 or newer.
Sep 23, 2026Real3D Flipbook: Does not perform capability checks on several of its authenticated flipbook management actionsCVE-2026-86842 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be leveraged to store JavaScript that executes in the context of any visitor or administrator viewing the site.
- Product
- Real3D Flipbook
- Fixed in
- 5.4
- What to do
- Update Real3D Flipbook to 5.4 or newer.
Sep 23, 2026Events Calendar: Does not perform a per-object capability check on one family of its REST write routesCVE-2026-84743 · WordPress plugins & themes · reported by WPScanLow 3.8
The Events Calendar WordPress plugin before 6.17.5 does not perform a per-object capability check on one family of its REST write routes, allowing users with a low-privilege role such as contributor to modify, unpublish, trash and take ownership of records belonging to other users, including administrators.
- Product
- Events Calendar
- Fixed in
- 6.17.5
- What to do
- Update Events Calendar to 6.17.5 or newer.
Sep 23, 2026Events Calendar: Does not check the capability required to publish content before creating or updating it through its REST APICVE-2026-84742 · WordPress plugins & themes · reported by WPScanLow 2.7
The Events Calendar WordPress plugin before 6.17.5 does not check the capability required to publish content before creating or updating it through its REST API, allowing users with a role that cannot normally publish, such as contributor, to publish content directly and bypass editorial review.
- Product
- Events Calendar
- Fixed in
- 6.17.5
- What to do
- Update Events Calendar to 6.17.5 or newer.
Sep 23, 2026Events Calendar: Does not check the post status of linked records before embedding their stored details into a public REST API responseCVE-2026-84741 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Events Calendar WordPress plugin before 6.17.5 does not check the post status of linked records before embedding their stored details into a public REST API response, allowing unauthenticated users to read the contents of records that have never been published.
- Product
- Events Calendar
- Fixed in
- 6.17.5
- What to do
- Update Events Calendar to 6.17.5 or newer.
Sep 23, 2026zportals: Does not perform any capability or nonce check on several of its AJAX actionsCVE-2026-18364 · WordPress plugins & themes · reported by WPScanMedium 4.3
The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-level account to modify the zportals WordPress plugin before 6.4.2's stored integration settings.
- Product
- zportals
- Fixed in
- 6.4.2
- What to do
- Update zportals to 6.4.2 or newer.
Sep 23, 2026Real3D Flipbook: Does not sanitize or escape several flipbook editor fields before rendering them back in the admin editorCVE-2025-15696 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the affected flipbook for editing, including administrators.
- Product
- Real3D Flipbook
- Fixed in
- 5.4
- What to do
- Update Real3D Flipbook to 5.4 or newer.
Sep 22, 2026WP Yelp Review Slider: Stored Cross-Site ScriptingCVE-2026-93778 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The WP Yelp Review Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source) in all versions up to, and including, 9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious payload originates from an anonymous Yelp reviewer on a public platform and requires no WordPress account; it is introduced into the database during the site administrator's ordinary use of the plugin's Download Reviews feature, making the effective attacker unauthenticated.
- Product
- WP Yelp Review Slider
- Affected
- up to 9.2
- What to do
- Affects up to 9.2. Update WP Yelp Review Slider to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 22, 2026The WP Ultimate Review: Arbitrary shortcode executionCVE-2026-92235 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The The WP Ultimate Review plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute arbitrary shortcodes.
- Product
- The WP Ultimate Review
- Affected
- up to 2.4.2
- What to do
- Affects up to 2.4.2. Update The WP Ultimate Review to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 22, 2026The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submiCVE-2026-91827 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator later exports form submissions to CSV, allowing unauthenticated attackers to perform PHP Object Injection; if a suitable POP chain is present via another installed plugin or theme, this can lead to actions such as arbitrary file operations or remote code execution.
- What to do
- Update the plugin to the newest version.
Sep 21, 2026Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-leveCVE-2026-93339 · WordPress plugins & themes · reported by VulnCheckMedium 5.1
Metaphor Creations Ditty (ditty-news-ticker) before 3.1.70 contains a stored cross-site scripting vulnerability that allows authenticated users with Author-level privileges or higher to inject arbitrary HTML elements by supplying malicious wrapper attribute values in layout tags. The ditty_layout_render_tag_wrapper() function inserts caller-supplied wrapper attribute values directly as HTML element names without allowlist validation, bypassing wp_kses_post() sanitization because KSES runs at save time before layout tag attributes are resolved at render time, causing the payload to execute in the browser of any visitor viewing posts or pages embedding the affected Ditty item.
- Fixed in
- 3.1.70
- What to do
- Update the plugin to 3.1.70 or newer.
Full record and what to do →NVD recordlazytitan.rowordpress.org
Sep 19, 2026WP Customer Reviews: Reflected Cross-Site ScriptingCVE-2026-11608 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The WP Customer Reviews plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpcr3_fname' parameter in all versions up to, and including, 3.7.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Product
- WP Customer Reviews
- Affected
- up to 3.7.8
- What to do
- Affects up to 3.7.8. Update WP Customer Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 19, 2026Mailchimp for WooCommerce: Does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routesCVE-2026-92435 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback for several of its REST API routes, allowing unauthenticated users to reach administrator-oriented endpoints and trigger a persistent state change.
- Product
- Mailchimp for WooCommerce
- Fixed in
- 6.1.1
- What to do
- Update Mailchimp for WooCommerce to 6.1.1 or newer.
Sep 19, 2026Hydra Booking — Appointment Scheduling & Booking Calendar: Does not perform object-level authorisation checks on several of its host-management operationsCVE-2026-92425 · WordPress plugins & themes · reported by WPScanMedium 5.5
The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.4 does not perform object-level authorisation checks on several of its host-management operations, allowing users who hold its own administrator-assigned custom role to read, modify and permanently delete other hosts' records and the WordPress user accounts linked to them.
- Product
- Hydra Booking — Appointment Scheduling & Booking Calendar
- Fixed in
- 1.2.4
- What to do
- Update Hydra Booking — Appointment Scheduling & Booking Calendar to 1.2.4 or newer.
Sep 19, 2026Estatik Real Estate: Does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX responseCVE-2026-76790 · WordPress plugins & themes · reported by WPScanHigh 7.1
The Estatik Real Estate Plugin WordPress plugin before 4.3.5 does not sanitise and escape several values decoded from a request parameter before reflecting them back in an unauthenticated AJAX response, leading to Reflected Cross-Site Scripting.
- Product
- Estatik Real Estate
- Fixed in
- 4.3.5
- What to do
- Update Estatik Real Estate to 4.3.5 or newer.
Sep 18, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Insecure Direct Object ReferenceCVE-2026-13471 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via the LatePointAbilityDeleteBooking::execute due to missing validation on a user controlled key. This makes it possible for attackers, with LatePoint Agent-level access and above, to read bookings and customer PII (full name, email, phone, and notes) assigned to other LatePoint agents, and delete arbitrary bookings by supplying any booking ID. This vulnerability is only exploitable when an administrator has enabled the Abilities API toggles (latepoint_abilities_api, latepoint_abilities_api_delete, and/or latepoint_abilities_api_edit) in the plugin settings.
- Product
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Affected
- up to 5.6.3
- What to do
- Affects up to 5.6.3. Update LatePoint – Calendar Booking Plugin for Appointments and Events to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.